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Ci, c 2 , c 3 <- 



STEP 31 



Ci computes i*i = f(P a ) 



STEP 32 



Q 



STEP 33 



Yi causes A to select adi 



STEP 34 



Ci 



adi 



STEP 35 
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f f 

d, C 2 , C 3 + PS < A STEP 41 



d computes rj = f(P C i) STEP 42 

C 2 computes r 2 = f(Pc2) 
C 3 computes r 3 = f(P C 3) 

ri 

Ci ► PS STEP 43 

C 2 ► PS 

r 3 

C 3 ► PS 

(xi, rO (x 2 , r 2 ) (x 3 , r 3 ) 
PS ► A STEP 44 

i*i causes A to select ad ri STEP 45 

(x 1? adO (x 2 , ad 2 ) (x 3 , ad 3 ) 
PS < — A STEP 46 

adi 

Ci, C 2 , C 3 + PS STEP 47 



FIGURE 4 
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Ci, C 2 , c 3 



Ci computes n = f(P C i) and encrypts E y [r,] 
C 2 computes r 2 = f(P C2 ) and encrypts E y [r 2 ] 
C 3 computes r 3 = f(P C 3) and encrypts E y [r 3 ] 

{ Ey[i*i], Xi} 
Q ^ BB 

{E y [r 2 ],x 2 } 
C 2 ► BB 

{E y [r 3 ],x 3 } 
C 3 ► BB 



k 

Servers collect Vj = { E y [rj], xj 

Servers mix Vj by random secret permutation a x 
to obtain V 2 = {r al Q, E y [a x {i)])} . * 

Servers replace each r y - in F 2 with tfd^ 
to obtain V 2 = {ad r , ^foCO])} * 

Servers mix V' 2 by random secret permutation <7 2 
to obtain V 3 = {(^[ad 0 2 (i) ], cr 2 (i)} . * 1 

Servers apply quorum controlled asymmetric proxy re-encryption 
k 

to obtain V 4 = (Ey Ci [ad ri ], i) 
Eyci[ad ri ] 

d,c 2 ,c 3 « A 



Q, C 2 , C 3 decrypt E yci [ad ri ] to receive ad ri 
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f 



c 



A 



C computes r = f(P) and encrypts E y [r] 



Ey[r,] 



C 



BB 



Servers encrypt adj to generate Ui = {(j, E y [adj])} n j=1 

Servers mix Uj by random secret permutation a 
to obtain U 2 = {E y [a{j)l E^ad^]) " 7 =i 

Servers perform a distributed plaintext equality test to 
find E y \j] ~ Ey[r] and obtain U 3 = (E y [r], E y [ad r ]) 

Servers apply quorum controlled asymmetric proxy re-encryption 
to obtain E yC j[ad r ] 



E yc i[ad r ] 



C 



A 



C decrypts E yci [ad r ] to receive ad r 



